Executive brief
A vulnerability in the Linux kernel's Mellanox Spectrum router driver could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue stems from how the system tracks network 'neighbors' (nearby devices on a network), leading to a memory error when the system tries to access information that has already been deleted. This could disrupt network operations or compromise the stability of data center switches using this hardware.
Technical details
A use-after-free vulnerability exists in the mlxsw_sp_neigh_entry_update function within the spectrum_router.c component of the Linux kernel. The root cause is a flawed reference counting scheme where the driver stores a pointer to a 'neighbour' structure without incrementing its reference count, leading to a dangling pointer when the neighbour is freed. An attacker with local access could trigger this condition during network configuration changes (e.g., RIF destruction or netdevice events), potentially leading to a kernel panic or local privilege escalation. The fix involves ensuring a reference is always taken when storing a neighbour pointer in a neighbour entry and properly releasing it during the entry's lifecycle.
Affected products
- Linux Linux Kernel 6cf3c971dc84 to a2dfe6758fc63e542105bee8b17a3a7485684db0
Timeline
- 2025-12-02: other: Patch authored
- 2026-01-11: patched: Patch committed to stable tree
- 2026-01-13: advisory: CVE published
References
- https://git.kernel.org/stable/c/4a3c569005f42ab5e5b2ad637132a33bf102cc08
- https://git.kernel.org/stable/c/675c5aeadf6472672c472dc0f26401e4fcfbf254
- https://git.kernel.org/stable/c/8b0e69763ef948fb872a7767df4be665d18f5fd4
- https://git.kernel.org/stable/c/9e0a0d9eeb0dbeba2c83fa837885b19b8b9230fc
- https://git.kernel.org/stable/c/a2dfe6758fc63e542105bee8b17a3a7485684db0
- https://git.kernel.org/stable/c/c437fbfd4382412598cdda1f8e2881b523668cc2
- https://git.kernel.org/stable/c/ed8141b206bdcfd5d0b92c90832eeb77b7a60a0a